test(tmpl): env access, built-in defaults, extends+include integration

- env_test.go: 4 tests for {{ env.VAR }}, env conditionals,
  missing env (no error), built-in defaults (VLESS_ENC, LOG_LEVEL),
  override of built-in defaults
- extends_test.go: integration test verifying {% extends %} + {% include %}
  in the same template — base inbound + child outbound + TLS partial all
  present in rendered output

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: hiddifydeveloper

internal/tmpl/env_test.go

@@ -0,0 +1,69 @@
+package tmpl
+
+import (
+	"bytes"
+	"testing"
+)
+
+func TestRender_EnvAccess(t *testing.T) {
+	t.Setenv("HCH_TEST_VAR", "hello-from-env")
+	src := []byte(`{"val": "{{ env.HCH_TEST_VAR }}"}`)
+	out, _, err := Render(src, map[string]string{})
+	if err != nil {
+		t.Fatalf("Render: %v", err)
+	}
+	if !bytes.Contains(out, []byte("hello-from-env")) {
+		t.Errorf("env var not substituted: %s", out)
+	}
+}
+
+func TestRender_EnvConditional(t *testing.T) {
+	t.Setenv("HCH_TEST_FLAG", "1")
+	src := []byte(`{"ok": {% if env.HCH_TEST_FLAG %}true{% else %}false{% endif %}}`)
+	out, _, err := Render(src, map[string]string{})
+	if err != nil {
+		t.Fatalf("Render: %v", err)
+	}
+	if !bytes.Contains(out, []byte("true")) {
+		t.Errorf("env conditional not working: %s", out)
+	}
+}
+
+func TestRender_EnvMissing(t *testing.T) {
+	// Unset env var should render as empty string, not error.
+	src := []byte(`{"val": "{{ env.HCH_DEFINITELY_NOT_SET_XYZ123 }}"}`)
+	out, _, err := Render(src, map[string]string{})
+	if err != nil {
+		t.Fatalf("Render: %v", err)
+	}
+	if bytes.Contains(out, []byte("HCH_DEFINITELY")) {
+		t.Errorf("missing env var leaked placeholder: %s", out)
+	}
+}
+
+func TestRender_BuiltinDefaults(t *testing.T) {
+	// VLESS_ENC, VLESS_DEC, LOG_LEVEL should have defaults when not set.
+	src := []byte(`{"enc":"{{ VLESS_ENC }}","dec":"{{ VLESS_DEC }}","log":"{{ LOG_LEVEL }}"}`)
+	out, _, err := Render(src, map[string]string{})
+	if err != nil {
+		t.Fatalf("Render: %v", err)
+	}
+	if !bytes.Contains(out, []byte(`"none"`)) {
+		t.Errorf("VLESS_ENC default not applied: %s", out)
+	}
+	if !bytes.Contains(out, []byte(`"error"`)) {
+		t.Errorf("LOG_LEVEL default not applied: %s", out)
+	}
+}
+
+func TestRender_BuiltinOverridable(t *testing.T) {
+	// Caller can override built-in defaults.
+	src := []byte(`{"enc":"{{ VLESS_ENC }}"}`)
+	out, _, err := Render(src, map[string]string{"VLESS_ENC": "xtls"})
+	if err != nil {
+		t.Fatalf("Render: %v", err)
+	}
+	if !bytes.Contains(out, []byte("xtls")) {
+		t.Errorf("VLESS_ENC override not applied: %s", out)
+	}
+}

internal/tmpl/extends_test.go

@@ -0,0 +1,59 @@
+package tmpl
+
+import (
+	"bytes"
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func TestRenderFile_ExtendsWithInclude(t *testing.T) {
+	// Build a temp dir tree mirroring the xray example structure.
+	root := t.TempDir()
+	baseDir := filepath.Join(root, "templates", "base")
+	tlsDir := filepath.Join(root, "templates", "tls")
+	exDir := filepath.Join(root, "vless-xhttp")
+	os.MkdirAll(baseDir, 0o755)
+	os.MkdirAll(tlsDir, 0o755)
+	os.MkdirAll(exDir, 0o755)
+
+	// Base template with block.
+	os.WriteFile(filepath.Join(baseDir, "client.json.j2"), []byte(`{
+  "inbounds": [{"tag":"socks-in","port":{{ SOCKS_PORT }}}],
+  "outbounds": [{% block outbound %}{"tag":"direct"}{% endblock %}]
+}`), 0o644)
+
+	// TLS partial.
+	os.WriteFile(filepath.Join(tlsDir, "client.tpl"), []byte(`"security": "{% if TLS %}tls{% else %}none{% endif %}",`), 0o644)
+
+	// Child template using extends + include.
+	child := filepath.Join(exDir, "client.json.j2")
+	os.WriteFile(child, []byte(`{% extends "../templates/base/client.json.j2" %}
+{% block outbound %}
+{
+  "tag": "vless-out",
+  "streamSettings": {
+    {% include "../templates/tls/client.tpl" %}
+    "network": "xhttp"
+  }
+}
+{% endblock %}`), 0o644)
+
+	vars := map[string]string{"SOCKS_PORT": "1080", "TLS": "1"}
+	out, _, err := RenderFile(child, vars)
+	if err != nil {
+		t.Fatalf("RenderFile: %v", err)
+	}
+	// Must have base inbound (socks-in) from extends.
+	if !bytes.Contains(out, []byte("socks-in")) {
+		t.Errorf("base inbound missing: %s", out)
+	}
+	// Must have child outbound (vless-out) from block.
+	if !bytes.Contains(out, []byte("vless-out")) {
+		t.Errorf("child outbound missing: %s", out)
+	}
+	// Must have TLS from include.
+	if !bytes.Contains(out, []byte(`"tls"`)) {
+		t.Errorf("tls include missing: %s", out)
+	}
+}